drop netlink-bounds-check-struct-nlmsgerr-creation.patch

diff --git a/queue-5.19/netlink-bounds-check-struct-nlmsgerr-creation.patch b/queue-5.19/netlink-bounds-check-struct-nlmsgerr-creation.patch
deleted file mode 100644 (file)
index 432466a..0000000
--- a/queue-5.19/netlink-bounds-check-struct-nlmsgerr-creation.patch
+++ /dev/null
@@ -1,81 +0,0 @@
-From c206ca228f9a8b60b3f0ba74a86d2df71f7f77d1 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Fri, 2 Sep 2022 21:37:49 -0700
-Subject: netlink: Bounds-check struct nlmsgerr creation
-
-From: Kees Cook <keescook@chromium.org>
-
-[ Upstream commit 710d21fdff9a98d621cd4e64167f3ef8af4e2fd1 ]
-
-In preparation for FORTIFY_SOURCE doing bounds-check on memcpy(),
-switch from __nlmsg_put to nlmsg_put(), and explain the bounds check
-for dealing with the memcpy() across a composite flexible array struct.
-Avoids this future run-time warning:
-
-  memcpy: detected field-spanning write (size 32) of single field "&errmsg->msg" at net/netlink/af_netlink.c:2447 (size 16)
-
-Cc: Jakub Kicinski <kuba@kernel.org>
-Cc: Pablo Neira Ayuso <pablo@netfilter.org>
-Cc: Jozsef Kadlecsik <kadlec@netfilter.org>
-Cc: Florian Westphal <fw@strlen.de>
-Cc: "David S. Miller" <davem@davemloft.net>
-Cc: Eric Dumazet <edumazet@google.com>
-Cc: Paolo Abeni <pabeni@redhat.com>
-Cc: syzbot <syzkaller@googlegroups.com>
-Cc: netfilter-devel@vger.kernel.org
-Cc: coreteam@netfilter.org
-Cc: netdev@vger.kernel.org
-Signed-off-by: Kees Cook <keescook@chromium.org>
-Link: https://lore.kernel.org/r/20220901071336.1418572-1-keescook@chromium.org
-Signed-off-by: David S. Miller <davem@davemloft.net>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- net/netfilter/ipset/ip_set_core.c | 8 +++++---
- net/netlink/af_netlink.c          | 8 +++++---
- 2 files changed, 10 insertions(+), 6 deletions(-)
-
-diff --git a/net/netfilter/ipset/ip_set_core.c b/net/netfilter/ipset/ip_set_core.c
-index 16ae92054baa..6b31746f9be3 100644
---- a/net/netfilter/ipset/ip_set_core.c
-+++ b/net/netfilter/ipset/ip_set_core.c
-@@ -1719,11 +1719,13 @@ call_ad(struct net *net, struct sock *ctnl, struct sk_buff *skb,
-               skb2 = nlmsg_new(payload, GFP_KERNEL);
-               if (!skb2)
-                       return -ENOMEM;
--              rep = __nlmsg_put(skb2, NETLINK_CB(skb).portid,
--                                nlh->nlmsg_seq, NLMSG_ERROR, payload, 0);
-+              rep = nlmsg_put(skb2, NETLINK_CB(skb).portid,
-+                              nlh->nlmsg_seq, NLMSG_ERROR, payload, 0);
-               errmsg = nlmsg_data(rep);
-               errmsg->error = ret;
--              memcpy(&errmsg->msg, nlh, nlh->nlmsg_len);
-+              unsafe_memcpy(&errmsg->msg, nlh, nlh->nlmsg_len,
-+                            /* Bounds checked by the skb layer. */);
-+
-               cmdattr = (void *)&errmsg->msg + min_len;
- 
-               ret = nla_parse(cda, IPSET_ATTR_CMD_MAX, cmdattr,
-diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
-index 0cd91f813a3b..d8d3ed2096a3 100644
---- a/net/netlink/af_netlink.c
-+++ b/net/netlink/af_netlink.c
-@@ -2440,11 +2440,13 @@ void netlink_ack(struct sk_buff *in_skb, struct nlmsghdr *nlh, int err,
-               return;
-       }
- 
--      rep = __nlmsg_put(skb, NETLINK_CB(in_skb).portid, nlh->nlmsg_seq,
--                        NLMSG_ERROR, payload, flags);
-+      rep = nlmsg_put(skb, NETLINK_CB(in_skb).portid, nlh->nlmsg_seq,
-+                      NLMSG_ERROR, payload, flags);
-       errmsg = nlmsg_data(rep);
-       errmsg->error = err;
--      memcpy(&errmsg->msg, nlh, payload > sizeof(*errmsg) ? nlh->nlmsg_len : sizeof(*nlh));
-+      unsafe_memcpy(&errmsg->msg, nlh, payload > sizeof(*errmsg)
-+                                       ? nlh->nlmsg_len : sizeof(*nlh),
-+                    /* Bounds checked by the skb layer. */);
- 
-       if (nlk_has_extack && extack) {
-               if (extack->_msg) {
--- 
-2.35.1
-

diff --git a/queue-5.19/series b/queue-5.19/series
index 113e4178fc334755b42f0f3ad93f24009684ef34..d41cf20455a93025bd75133dc099e52bc1aa12e8 100644 (file)
--- a/queue-5.19/series
+++ b/queue-5.19/series
@@ -650,7 +650,6 @@ net-next-fix-ip_unicast_if-option-behavior-for-conne.patch
 xfrm-update-ipcomp_scratches-with-null-when-freed.patch
 wifi-ath11k-register-shutdown-handler-for-wcn6750.patch
 rtw89-ser-leave-lps-with-mutex.patch
-netlink-bounds-check-struct-nlmsgerr-creation.patch
 net-ftmac100-fix-endianness-related-issues-from-spar.patch
 iavf-fix-race-between-iavf_close-and-iavf_reset_task.patch
 wifi-brcmfmac-fix-use-after-free-bug-in-brcmf_netdev.patch

diff --git a/queue-6.0/netlink-bounds-check-struct-nlmsgerr-creation.patch b/queue-6.0/netlink-bounds-check-struct-nlmsgerr-creation.patch
deleted file mode 100644 (file)
index 584db82..0000000
--- a/queue-6.0/netlink-bounds-check-struct-nlmsgerr-creation.patch
+++ /dev/null
@@ -1,81 +0,0 @@
-From 6149fbd4cbf5170fd911954d98385f53cbb7453e Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Fri, 2 Sep 2022 21:37:49 -0700
-Subject: netlink: Bounds-check struct nlmsgerr creation
-
-From: Kees Cook <keescook@chromium.org>
-
-[ Upstream commit 710d21fdff9a98d621cd4e64167f3ef8af4e2fd1 ]
-
-In preparation for FORTIFY_SOURCE doing bounds-check on memcpy(),
-switch from __nlmsg_put to nlmsg_put(), and explain the bounds check
-for dealing with the memcpy() across a composite flexible array struct.
-Avoids this future run-time warning:
-
-  memcpy: detected field-spanning write (size 32) of single field "&errmsg->msg" at net/netlink/af_netlink.c:2447 (size 16)
-
-Cc: Jakub Kicinski <kuba@kernel.org>
-Cc: Pablo Neira Ayuso <pablo@netfilter.org>
-Cc: Jozsef Kadlecsik <kadlec@netfilter.org>
-Cc: Florian Westphal <fw@strlen.de>
-Cc: "David S. Miller" <davem@davemloft.net>
-Cc: Eric Dumazet <edumazet@google.com>
-Cc: Paolo Abeni <pabeni@redhat.com>
-Cc: syzbot <syzkaller@googlegroups.com>
-Cc: netfilter-devel@vger.kernel.org
-Cc: coreteam@netfilter.org
-Cc: netdev@vger.kernel.org
-Signed-off-by: Kees Cook <keescook@chromium.org>
-Link: https://lore.kernel.org/r/20220901071336.1418572-1-keescook@chromium.org
-Signed-off-by: David S. Miller <davem@davemloft.net>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- net/netfilter/ipset/ip_set_core.c | 8 +++++---
- net/netlink/af_netlink.c          | 8 +++++---
- 2 files changed, 10 insertions(+), 6 deletions(-)
-
-diff --git a/net/netfilter/ipset/ip_set_core.c b/net/netfilter/ipset/ip_set_core.c
-index 16ae92054baa..6b31746f9be3 100644
---- a/net/netfilter/ipset/ip_set_core.c
-+++ b/net/netfilter/ipset/ip_set_core.c
-@@ -1719,11 +1719,13 @@ call_ad(struct net *net, struct sock *ctnl, struct sk_buff *skb,
-               skb2 = nlmsg_new(payload, GFP_KERNEL);
-               if (!skb2)
-                       return -ENOMEM;
--              rep = __nlmsg_put(skb2, NETLINK_CB(skb).portid,
--                                nlh->nlmsg_seq, NLMSG_ERROR, payload, 0);
-+              rep = nlmsg_put(skb2, NETLINK_CB(skb).portid,
-+                              nlh->nlmsg_seq, NLMSG_ERROR, payload, 0);
-               errmsg = nlmsg_data(rep);
-               errmsg->error = ret;
--              memcpy(&errmsg->msg, nlh, nlh->nlmsg_len);
-+              unsafe_memcpy(&errmsg->msg, nlh, nlh->nlmsg_len,
-+                            /* Bounds checked by the skb layer. */);
-+
-               cmdattr = (void *)&errmsg->msg + min_len;
- 
-               ret = nla_parse(cda, IPSET_ATTR_CMD_MAX, cmdattr,
-diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
-index 0cd91f813a3b..d8d3ed2096a3 100644
---- a/net/netlink/af_netlink.c
-+++ b/net/netlink/af_netlink.c
-@@ -2440,11 +2440,13 @@ void netlink_ack(struct sk_buff *in_skb, struct nlmsghdr *nlh, int err,
-               return;
-       }
- 
--      rep = __nlmsg_put(skb, NETLINK_CB(in_skb).portid, nlh->nlmsg_seq,
--                        NLMSG_ERROR, payload, flags);
-+      rep = nlmsg_put(skb, NETLINK_CB(in_skb).portid, nlh->nlmsg_seq,
-+                      NLMSG_ERROR, payload, flags);
-       errmsg = nlmsg_data(rep);
-       errmsg->error = err;
--      memcpy(&errmsg->msg, nlh, payload > sizeof(*errmsg) ? nlh->nlmsg_len : sizeof(*nlh));
-+      unsafe_memcpy(&errmsg->msg, nlh, payload > sizeof(*errmsg)
-+                                       ? nlh->nlmsg_len : sizeof(*nlh),
-+                    /* Bounds checked by the skb layer. */);
- 
-       if (nlk_has_extack && extack) {
-               if (extack->_msg) {
--- 
-2.35.1
-

diff --git a/queue-6.0/series b/queue-6.0/series
index 861961746866a9d5a77b3e18463145544b05b335..c647eac25d1a2894159538ef56a1d3236fe3ad8f 100644 (file)
--- a/queue-6.0/series
+++ b/queue-6.0/series
@@ -724,7 +724,6 @@ net-next-fix-ip_unicast_if-option-behavior-for-conne.patch
 xfrm-update-ipcomp_scratches-with-null-when-freed.patch
 wifi-ath11k-register-shutdown-handler-for-wcn6750.patch
 rtw89-ser-leave-lps-with-mutex.patch
-netlink-bounds-check-struct-nlmsgerr-creation.patch
 net-ftmac100-fix-endianness-related-issues-from-spar.patch
 iavf-fix-race-between-iavf_close-and-iavf_reset_task.patch
 wifi-brcmfmac-fix-use-after-free-bug-in-brcmf_netdev.patch